Cloud platform policy
Cloud settings controlled by the deployment operator.
The following settings belong to the platform rather than a customer tenant. Customer-facing instance APIs return 404 in cloud mode; operators change environment-pinned values through the deployment and roll them out together.
| Setting | Cloud boundary |
|---|---|
| SMTP identity and relay | One environment-pinned relay. Tenant content never supplies envelope credentials or platform branding. |
| Profile storage | One environment-pinned private store; every avatar key is prefixed by organization and membership is checked before reads. Cloud requires S3-compatible storage or STATUS_SHARED_FILESYSTEM=true with an explicit shared mount. |
| Shared worker credential | Environment-only and platform-internal. Customers can create only organization-bound private-agent credentials. |
| VAPID keys | One platform key pair; subscriptions and delivery queries remain organization/member scoped. |
| CSP and framing | Generated per request. Console, status, badge, and embed surfaces keep distinct policies; tenant CSS cannot alter headers. |
| Resource/storage quota | Plan limits gate tenant resource counts and retention. Over-limit tenants become read-only; the platform never deletes resources to enforce a downgrade. |
| Audit retention | Audit rows are retained through account and organization purge with the former org slug; no tenant can lower the platform retention boundary. |
| Backup/restore | Instance-wide shared fate only, with an explicit cloud acknowledgement. Per-org portability uses export/import rather than selective database restore. |
| Platform administration | Solarius staff operate the deployment from the cloud platform console, behind employee SSO and a platform_admins grant that no tenant role can produce. Staff see tenant metadata and configuration, never customer content, and cannot sign in as a customer. Plan changes and suspensions make a tenant read-only with export intact; the platform never deletes resources to enforce a policy. |